Your master password never leaves
Keys are derived on your device with Argon2id, a memory-hard function built to break password-cracking rigs. Only a separate authentication hash is ever sent — it cannot decrypt anything.
- AES-256-GCMauthenticated encryption
- Argon2idmemory-hard KDF
- Zero-knowledgeby architecture, not policy
- Web + Androidone encrypted vault
- EN + FAPersian-first, full RTL
How it works
Zero-knowledge, in three moves.
Not a promise in a privacy policy — a property of the architecture. The server is designed so it never holds anything worth stealing.
Everything is sealed before upload
Every item — titles included — is encrypted with AES-256-GCM on your device. Each item gets its own random data key, wrapped by your vault key. Tampering with a single byte makes decryption fail loudly.
The server keeps locked boxes, no keys
What reaches Dezh is ciphertext and wrapped keys. Authentication and encryption are derived from four independent salts, so proving who you are never reveals how to read your data.
v1.<base64url(iv)>.<base64url(ciphertext + tag)>Features
A full keychain, not just a list.
Everything you expect from a modern password manager — with the fortress architecture underneath.
Encrypted vault
Logins, cards, notes, and custom fields — every field encrypted client-side, organized with categories, colors, and icons.
Password generator
Strong, tunable passwords and passphrases, scored as you type. Generated locally — never sent anywhere.
Vault health
Find weak, reused, and aging passwords with a health score computed on your device, over decrypted data only you can see.
Cross-device sync
Your encrypted vault follows you between Android and the web. The sync pipeline moves ciphertext only.
Dezh Web, paired to your phone
Open your vault in any browser — your phone stays the key. Every browser is approved on your phone and can read only the items you allow, unlocked while your phone permits it; revoke it in a tap. Free once a month, unlimited on Pro.
Account recovery
Recovery questions derive a separate recovery key on your device — so you can recover without Dezh ever knowing the answers.
Two-factor login
TOTP-based 2FA hardens sign-in, and can optionally serve as a break-glass path to reset a lost master password.
Encrypted backups
Export a portable .dezh file sealed with its own passphrase and a deliberately heavier KDF. Restore it anywhere, even without an account.
Biometric unlock & self-destruct
Face or fingerprint unlock, pattern unlock, auto-lock, clipboard auto-clear — and an optional local wipe after repeated failed attempts.
Security design
What our servers can never do.
The full cryptographic design is written down, and available on request. This is the short version — the trust boundary in plain words.
✕ The server cannot
- Read your master password — it never receives it
- Derive your encryption key from anything it stores
- Decrypt your vault items or their titles
- Read your recovery answers — only salted hashes arrive
- Open a .dezh backup — its passphrase never leaves your device
✓ The server can
- Verify it is really you, via a derived authentication hash
- Store and sync your sealed ciphertext between devices
- Enforce plan limits and manage sessions
- Purge everything, permanently, when you delete your account
Four salts, four independent keys
One master password, four cryptographically separated jobs. Compromising any one path reveals nothing about the others.
| salt | → | derived key | purpose |
|---|---|---|---|
| authSalt | authHash | proves identity — safe to send | |
| encSalt | masterKey | unwraps the vault key — never sent | |
| recSalt | recoveryKey | recovery path — derived from your answers | |
| totpWrapSalt | totpKey | optional 2FA reset path |
Your vault key is a random 256-bit key generated once, on your device. The server only ever sees it wrapped — locked boxes, none of the keys.
Pricing
One price. Every platform. Same encryption.
The free tier is a real vault, not a trial. Pro lifts the limits and adds the things that only matter once Dezh is where all your secrets live.
Free
$0
Forever. No card.
- 25 vault items
- AES-256 / Argon2id — identical to Pro
- Passkey sign-in on web and mobile
- Two-factor authentication on your account
- A fully local vault with no account at all
- Biometric and pattern unlock
- Password generator and health check
- 3 cloud syncs between devices
- Open your vault in a browser once a month
- CSV export and manual encrypted backup
Pro
from $1.25 / month
Billed yearly at $14.99, or monthly. Lifetime available.
- Unlimited vault items
- Unlimited cloud sync and automatic encrypted backups
- Encrypted attachments — 4 MB per file, 20 per item
- Unlimited browser sessions, with a timeout you control
- Keep your browser signed in when your phone goes offline
- An encrypted, read-only copy of your vault in your browser, unlocked by your passkey
- Unlimited categories and custom field templates
- Password history
- Floating quick-access window (Android)
- XLSX and PDF export
- Biometric lock on settings, and self-destruct
- App icons and themes
Buy once and Pro works on Android and the web. Attachments you already uploaded stay readable even if your subscription lapses.
FAQ
Fair questions, straight answers.
What happens if I forget my master password?
If you set up recovery questions, you can derive a recovery key on your device and regain access without Dezh ever learning your answers. If you lose both the master password and the recovery path, your vault is permanently unreadable — by you, by us, by anyone. That is not a bug; it is the zero-knowledge guarantee doing its job.
Can Dezh employees read my passwords?
No. Your items are encrypted on your device with keys derived from your master password, which never leaves it. Our servers store ciphertext and wrapped keys. There is no admin tool, support flow, or database query that can decrypt your vault — the data needed to do so simply is not there.
Is Dezh free?
Yes — the free tier includes the encrypted vault (up to 25 items), the password generator, vault health, and limited sync. Pro removes the limits. Encryption is identical on every tier; we do not sell weaker cryptography.
Does Dezh work in Persian?
Fully. Dezh is bilingual English + Persian with complete right-to-left layouts across the app and this site — not a translated afterthought, but a first-class experience built on the Vazirmatn typeface.
How do I delete my account and data?
Any time, without asking support: from the app settings or the public deletion page. Deletion is verified with your master-derived credentials, then your authentication record, encrypted vault, sync history, and billing linkage are hard-deleted. See the delete-account page for the exact scope.
What does “Dezh” mean?
“Dezh” (دژ) is Persian for fortress — a stronghold built to withstand siege. It is also a design brief: your secrets live inside walls that even the people who built them cannot breach.
Move your secrets behind walls.
Set up your vault in minutes. Free to start — no card, no tracking, no keys on our side.
Free tier: 25 items, full encryption. Forever.